topic Re: Line up sources in chart in Dashboards & Visualizations

Line up sources in chart

gnovak — Wed, 11 Apr 2012 20:19:31 GMT

Is there a way to graph a chart where the sources will line up next to each other? From the example above, I want totalemailssent and totalemailtosend from one source to be side by side in the chart.

Example: the highest 2 columns in the chart are the same source for each day. Can I get them to show up side by side?

My code to make the chart is:

<chart>
  <searchString>sourcetype="cron_BalanceEmail" NOT host="*.bmp2.*" earliest=-7d@d latest=-0d@d sent (\[BalanceEmail\] OR \[null\])   | rex field=_raw "\w+\] ?(?&lt;TotalEmailsSent&gt;[\d]+) of (?&lt;TotalEmailsToSend&gt;[\d]+) of email notification sent\." | rex field=source "/(?&lt;registrar&gt;[^/]+)/[^/]+/[^/]+$" | timechart sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent by registrar</searchString>
  <title>Balance Emails Combined - 7 days</title>
  <earliestTime>0</earliestTime>
  <option name="charting.chart">column</option>
  <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
</chart>

Re: Line up sources in chart

tysonstewart — Wed, 11 Apr 2012 21:04:47 GMT

Yeah, try tacking a table command on the end of your search string:

... | table totalemailsent,totalemailtosend, *

Re: Line up sources in chart

gnovak — Wed, 11 Apr 2012 22:13:55 GMT

nay that didn't work.

Re: Line up sources in chart

tysonstewart — Wed, 11 Apr 2012 22:43:02 GMT

Gotcha. Sorry, needed to read a little closer. You'll have to spell out all the column names, but the table command should still do what you're looking for:

... | table _time,"TotalEmailsToSend: <registrar>","TotalEmailsSent: <registrar>",...

Casing and spaces matter.

Re: Line up sources in chart

gnovak — Thu, 19 Apr 2012 20:43:32 GMT

Tysonsteward, this works, but the time for some reason is really long. Instead of the time just being a simple date like April 19 2012 it's long and drawn out like 2012-04-15T00:00:00:000-04:00...any idea why?

Re: Line up sources in chart

tysonstewart — Thu, 19 Apr 2012 21:07:00 GMT

Hmm. Unexpected. Well, you can counter that by using an eval before the table command:

... | eval Time=strftime(_time,"%a %b %e") | table Time,"TotalEmailsToSend: <registrar>",...

Then you can format your time however you please. A guide to strftime strings can be found at http://strftime.org/

Re: Line up sources in chart

gnovak — Thu, 19 Apr 2012 21:43:50 GMT

This is wonderful. Works good. I just need the year (2012) but I don't see this on the link. Thanks for this. I'll be taking some python training soon so any exposure is a +

Re: Line up sources in chart

gnovak — Thu, 19 Apr 2012 21:46:45 GMT

also is the %e a mistake on your part? It's not in the chart from the link you posted. 😞

Re: Line up sources in chart

gnovak — Thu, 19 Apr 2012 21:48:48 GMT

Interesting! http://www.velocityreviews.com/forums/t648500-why-e-not-in-time-strftime-directives.html

Re: Line up sources in chart

tysonstewart — Thu, 19 Apr 2012 22:05:23 GMT

Yeah, %e is just one of those weird ones. It works for me. I say try it, and if it doesn't, fall back on %d. %Y will give you a 4-digit year (it's near the bottom on that link).

Re: Line up sources in chart

gnovak — Thu, 19 Apr 2012 22:23:07 GMT

This worked. I missed that %Y. Great stuff...thanks for the help!